Method and Apparatus for Migrating a Virtual TPM Instance and Preserving Uniqueness and Completeness of the Instance

ABSTRACT

A migration scheme for virtualized Trusted Platform Modules is presented. The procedure is capable of securely migrating an instance of a virtual Trusted Platform Module from one physical platform to another. A virtual Trusted Platform Module instance&#39;s state is downloaded from a source virtual Trusted Platform Module and all its state information is encrypted using a hybrid of public and symmetric key cryptography. The encrypted state is transferred to the target physical platform, decrypted and the state of the virtual Trusted Platform Module instance is rebuilt.

This application is a continuation of application Ser. No. 12/114,133,filed May 2, 2008, status allowed.

BACKGROUND

1. Field

The present invention relates generally to the data processing field.Specifically, the present invention provides a computer implementedmethod, a data processing system, and a computer program product formigrating a virtual Trusted Platform Module instance.

2. Description of the Related Art

The Trusted Computing Group has defined the functionality and protocolfor a hardware module called the Trusted Platform Module (TPM). Thispiece of hardware offers security and cryptographic functionality tocomputer systems such as, for example, asymmetric key generation,decryption, encryption, signing, sealing and binding of data to thestate of the TPM, migration of keys between TPMs, random numbergeneration and hashing functionality. A TPM also holds state in forms ofstored keys, non-volatile memory areas and platform configurationregisters.

Many hardware vendors ship their computing systems equipped with a TPMsoldered to the motherboard, which allows widespread usage of the TPM byoperating systems such as Linux® or Windows®.

The interest in support for trusted computing on virtualizeable systemsis growing as hardware virtualization becomes available for common, offthe shelf hardware. Being able to run multiple operating systems on onemachine will not remain an area reserved for high-end servers but willbecome widely available. To support trusted computing for each operatingsystem on a virtualized system, a virtual Trusted Platform Module ispreferred to be made available that makes each such operating systemthink that it is talking to its own private TPM.

Virtualization support for an operating system is enabled through anadditional software layer underneath operating systems running on aplatform. Whereas usually operating systems are running directly on thehardware, in a virtualizeable system a layer called a ‘hypervisor’ or‘virtual machine monitor’ is implementing a virtual machine where anoperating system can be run inside. The hypervisor becomes the lowestsoftware layer in the system.

Modern virtualization technologies enable the migration of a virtualmachine from one platform to another one. If the operating system insidethe virtual machine is associated with a virtual TPM, then that virtualTPM is desired to be able to migrate its state to the new platform suchthat TPM functionality is available on the target platform.

SUMMARY

Various aspects of the invention describe a computer implemented methodand a data processing system for securely migrating an instance of avirtual TPM from one platform to another. During the process ofmigration the uniqueness of the virtual TPM instance is preserved. It isalso secured that only the complete and unmodified state of the virtualTPM instance is migrated such that attempts to omit or alter state ofthe virtual TPM instance are detected. All state information that istransferred is encrypted by the virtual TPM on the source platform andis decrypted by the virtual TPM on the destination platform.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The novel features believed characteristic of the invention are setforth in the appended claims. The invention itself, however, as well asa preferred mode of use, further objectives and advantages thereof, willbest be understood by reference to the following detailed description ofan illustrative embodiment when read in conjunction with theaccompanying drawings, wherein:

FIG. 1 is a pictorial representation of a network of data processingsystems in which exemplary aspects of the present invention may beimplemented;

FIG. 2 is a block diagram of a data processing system in which exemplaryaspects of the present invention may be implemented;

FIG. 3 is a block diagram showing typical software architecture for aserver or client system in accordance with a preferred embodiment of thepresent invention;

FIG. 4 is a block diagram depicting an example of migrating a virtualTPM instance to a physically separate destination platform, inaccordance with an exemplary embodiment of the present invention;

FIG. 5 is a diagram of information flow that describes the high levelprocedure of migrating a virtual TPM instance from a source platform toa destination platform, in accordance with an exemplary embodiment ofthe present invention;

FIG. 6 is a diagram of information flow for migrating a virtual TPMinstance, in accordance with an exemplary embodiment of the presentinvention;

FIG. 7 is a diagram of information flow for exporting the stateinformation of a virtual TPM instance in multiple steps, in accordancewith an exemplary embodiment of the present invention;

FIG. 8 is a diagram of information flow for exporting the stateinformation of a virtual TPM instance in a single step, in accordancewith an exemplary embodiment of the present invention;

FIG. 9 is a flowchart illustrating the operation of handling TPMcommands, in accordance with an exemplary embodiment of the presentinvention;

FIG. 10 is a flowchart illustrating the operation of handling thecommand for creation of a virtual TPM instance in accordance with anexemplary embodiment of the present invention;

FIG. 11 is a flowchart illustrating the operation of handling thecommand for locking of a virtual TPM instance in accordance with anexemplary embodiment of the present invention;

FIG. 12 is a flowchart illustrating the operation of handling thecommand for getting a virtual TPM instance key in accordance with anexemplary embodiment of the present invention;

FIG. 13 is a flowchart illustrating the operation of handling thecommand for getting virtual TPM instance data in accordance with anexemplary embodiment of the present invention;

FIG. 14 is a flowchart illustrating the operation of handling thecommand for deleting a virtual TPM instance in accordance with anexemplary embodiment of the present invention;

FIG. 15 is a flowchart illustrating the operation of handling thecommand for setting a virtual TPM instance key in accordance with anexemplary embodiment of the present invention;

FIG. 16 is a flowchart illustrating the operation of handling thecommand for setting virtual TPM instance data in accordance with anexemplary embodiment of the present invention; and

FIG. 17 is a flowchart illustrating the operation of handling thecommand for unlocking a virtual TPM instance in accordance with anexemplary embodiment of the present invention.

DETAILED DESCRIPTION

FIGS. 1-2 are provided as exemplary diagrams of data processingenvironments in which embodiments of the present invention may beimplemented. It should be appreciated that FIGS. 1-2 are only exemplaryand are not intended to assert or imply any limitation with regard tothe environments in which aspects or embodiments of the presentinvention may be implemented. Many modifications to the depictedenvironments may be made without departing from the spirit and scope ofthe present invention.

With reference now to the figures, FIG. 1 depicts a pictorialrepresentation of a network of data processing systems in which aspectsof the present invention may be implemented. Network data processingsystem 100 is a network of computers in which embodiments of the presentinvention may be implemented. Network data processing system 100contains network 102, which is the medium used to provide communicationslinks between various devices and computers connected together withinnetwork data processing system 100. Network 102 may include connections,such as wire, wireless communication links, or fiber optic cables.

In the depicted example, server 104 and server 106 connect to network102 along with storage unit 108. In addition, clients 110, 112, and 114connect to network 102. These clients 110, 112, and 114 may be, forexample, personal computers or network computers. In the depictedexample, server 104 provides data, such as boot files, operating systemimages, and applications to clients 110, 112, and 114. Clients 110, 112,and 114 are clients to server 104 in this example. Network dataprocessing system 100 may include additional servers, clients, and otherdevices not shown.

In the depicted example, network data processing system 100 is theInternet with network 102 representing a worldwide collection ofnetworks and gateways that use the Transmission ControlProtocol/Internet Protocol (TCP/IP) suite of protocols to communicatewith one another. At the heart of the Internet is a backbone ofhigh-speed data communication lines between major nodes or hostcomputers, consisting of thousands of commercial, governmental,educational and other computer systems that route data and messages. Ofcourse, network data processing system 100 also may be implemented as anumber of different types of networks, such as for example, an intranet,a local area network (LAN), or a wide area network (WAN). FIG. 1 isintended as an example, and not as an architectural limitation fordifferent embodiments of the present invention.

With reference now to FIG. 2, a block diagram of a data processingsystem is shown in which aspects of the present invention may beimplemented. Data processing system 200 is an example of a computer,such as server 104 or client 110 in FIG. 1, in which computer usablecode or instructions implementing the processes for embodiments of thepresent invention may be located.

In the depicted example, data processing system 200 employs a hubarchitecture including north bridge and memory controller hub (NB/MCH)202 and south bridge and input/output (I/O) controller hub (SB/ICH) 204.Processing unit 206, main memory 208, and graphics processor 210 areconnected to north bridge and memory controller hub 202. Graphicsprocessor 210 may be connected to north bridge and memory controller hub202 through an accelerated graphics port (AGP).

In the depicted example, LAN adapter 212 connects to south bridge andI/O controller hub 204. Audio adapter 216, keyboard and mouse adapter220, TPM 222, read only memory (ROM) 224, hard disk drive (HDD) 226,CD-ROM drive 230, universal serial bus (USB) ports and othercommunications ports 232, and PCI/PCIe devices 234 connect to southbridge and I/O controller hub 204 through bus 238 and bus 240. PCI/PCIedevices may include, for example, Ethernet adapters, add-in cards and PCcards for notebook computers, and TPM 222. PCI uses a card buscontroller, while PCIe does not. ROM 224 may be, for example, a flashbinary input/output system (BIOS).

Hard disk drive 226 and CD-ROM drive 230 connect to south bridge and I/Ocontroller hub 204 through bus 240. Hard disk drive 226 and CD-ROM drive230 may use, for example, an integrated drive electronics (IDE) orserial advanced technology attachment (SATA) interface. Super I/O (SIO)device 236 may be connected to south bridge and I/O controller hub 204.

An operating system runs on processing unit 206 and coordinates andprovides control of various components within data processing system 200in FIG. 2. As a client, the operating system may be a commerciallyavailable operating system such as Microsoft® Windows® XP (Microsoft andWindows are trademarks of Microsoft Corporation in the United States,other countries, or both). An object-oriented programming system, suchas the Java™ programming system, may run in conjunction with theoperating system and provides calls to the operating system from Javaprograms or applications executing on data processing system 200 (Javais a trademark of Sun Microsystems, Inc. in the United States, othercountries, or both).

As a server, data processing system 200 may be, for example, an IBMeServer™ pSeries® computer system, running the Advanced InteractiveExecutive (AIX®) operating system or LINUX operating system (eServer,pSeries and AIX are trademarks of International Business MachinesCorporation in the United States, other countries, or both while Linuxis a trademark of Linus Torvalds in the United States, other countries,or both). Data processing system 200 may be a symmetric multiprocessor(SMP) system including a plurality of processors in processing unit 206.Alternatively, a single processor system may be employed.

Instructions for the operating system, the object-oriented programmingsystem, and applications or programs are located on storage devices,such as hard disk drive 226, and may be loaded into main memory 208 forexecution by processing unit 206. The processes for embodiments of thepresent invention are performed by processing unit 206 using computerusable program code, which may be located in a memory such as, forexample, main memory 208, read only memory 224, or in one or moreperipheral devices 226 and 230.

Those of ordinary skill in the art will appreciate that the hardware inFIGS. 1-2 may vary depending on the implementation. Other internalhardware or peripheral devices, such as flash memory, equivalentnon-volatile memory, or optical disk drives and the like, may be used inaddition to or in place of the hardware depicted in FIGS. 1-2. Also, theprocesses of the present invention may be applied to a multiprocessordata processing system.

In some illustrative examples, data processing system 200 may be apersonal digital assistant (PDA), which is configured with flash memoryto provide non-volatile memory for storing operating system files and/oruser-generated data.

A bus system may be comprised of one or more buses, such as bus 238 orbus 240 as shown in FIG. 2. Of course the bus system may be implementedusing any type of communications fabric or architecture that providesfor a transfer of data between different components or devices attachedto the fabric or architecture. A communications unit may include one ormore devices used to transmit and receive data, such as network adapter212 of FIG. 2. A memory may be, for example, main memory 208, read onlymemory 224, or a cache such as found in north bridge and memorycontroller hub 202 in FIG. 2. The depicted examples in FIGS. 1-2 andabove-described examples are not meant to imply architecturallimitations. For example, data processing system 200 also may be atablet computer, laptop computer, or telephone device in addition totaking the form of a PDA.

Turning to FIG. 3, typical software architecture, generally designatedby reference number 300, for a server-client system is depicted inaccordance with a preferred embodiment of the present invention.Operating system 302 is utilized to provide high-level functionality tothe user and to other software. Operating system 302 may be implementedin server 104 or client 110 in FIG. 1, in which computer usable code orinstructions implementing the processes for embodiments of the presentinvention may be located. Such an operating system typically includesBIOS. Communication software 304 provides communications through anexternal port to a network such as the Internet via a physicalcommunications link by either directly invoking operating systemfunctionality or indirectly bypassing the operating system to access thehardware for communications over the network.

Application programming interface (API) 306 allows the user of thesystem, an individual, or a software routine, to invoke systemcapabilities using a standard consistent interface without concern forhow the particular functionality is implemented. Network access software308 represents any software available for allowing the system to accessa network. This access may be to a network, such as a LAN, WAN, or theInternet. With the Internet, this software may include programs, such asWeb browsers.

Application software 310 represents any number of software applicationsdesigned to react to data through a communications port to provide thedesired functionality the user seeks. Applications at this level mayinclude those necessary to handle data, video, graphics, photos or text,which can be accessed by users of the Internet. Hypervisor 312 is alayer of software running on a platform that allows multiple instancesof operating systems to be running simultaneously.

The TPM is a security specification defined by the Trusted ComputingGroup. The implementation of a TPM is available as a chip that isphysically attached to the platform's motherboard and controlled bysoftware running on the system using well-defined commands. The TPMprovides cryptographic operations such as asymmetric key generation,decryption, encryption, signing, migration of keys between TPMs, as wellas random number generation and hashing. The TPM also provides securestorage for small amounts of information such as cryptographic keys.

Computer systems that have the capability of running multiple operatingsystems at the same time will desire to extend support for trustedcomputing in a similar way as it has been made available for singleoperating system environments. In such a case, each virtual machineneeds to have access to its own TPM. For the purposes of thisapplication, such a TPM is referred to as a virtual TPM instance, whichis spawned by an entity called a virtual TPM.

Each operating system is offered its own virtual TPM instance. In anexemplary embodiment of the present invention, the normal command setthat a TPM understands is expanded to enable the download of thecomplete state of a virtual TPM instance, such as, for example,non-volatile RAM (NV RAM) areas, and internally held keys into a fileand recreating the virtual TPM state in another multi-instance capablevirtual TPM and resuming operation there.

This particular extension enables migration of a virtual TPM instancealong with an operating system running inside of a virtual machine fromone physical platform to another physical platform. All downloaded statefrom the virtual TPM instance is encrypted with a symmetric key. Thesymmetric key is also downloaded, but will itself be encrypted by amigrateable storage key. To recreate the state of a virtual TPM instanceon another system, the migrateable storage key is preferred to be madeavailable there first in order to be able to use the symmetric key thatis securely kept in encrypted form. The possibility of virtual TPMinstance migration between systems requires interoperability on severallevels. First, virtual TPM implementations should implement the sameextended command set that allows the migration of the virtual TPMinstance. Second, the virtual TPM instance state that the sourceplatform application is writing to a file should be readable by a toolor application on the target system.

For an exemplary embodiment of the present invention, it is assumed thata hierarchy of virtual TPM instances has been formed where a parentvirtual TPM instance has control over the life-cycle of its childinstances. A parent virtual TPM instance can, for example, create newvirtual TPM child instances as well as retrieve their state informationor delete them.

In an exemplary embodiment of the present invention, a virtual TPMinstance is downloaded from a source platform and all its stateinformation is encrypted by a parent virtual TPM instance on the sourceplatform using a hybrid of public and symmetric key cryptography. Theencrypted state is transferred to the target physical platform,decrypted and the state of the virtual TPM instance is rebuilt.

In another exemplary embodiment, the uniqueness of the migrated virtualTPM instance is preserved by ensuring that the trusted platform modulecan only be recreated on one single target platform. In anotherexemplary embodiment, integrity data ensures that only the full andunmodified state of the migrated virtual TPM instance can be recreated.In another exemplary embodiment of the present invention, theto-be-migrated virtual TPM instance's state is destroyed on the sourceplatform.

In another exemplary embodiment of the present invention, support for aclient system is provided. A client could request to migrate a virtualTPM instance. In one exemplary embodiment, a reply package including amigration application is sent to the client. The migration applicationneeds to be installed on both the source and the destination platforms.The migration application is a program that sends commands to the parentvirtual trusted platform module for causing the serialization of thestate of the virtual TPM instance and enables the user to use theextended command set that allows the download of the state of thevirtual TPM instance. In another exemplary embodiment, the migrationapplication may include computer useable program code to automaticallydownload the state of the virtual TPM instance and transfer the state tothe destination platform for the purpose of recreating the state there.In another exemplary embodiment, the migration application may alsoinclude computer useable program code for gathering information aboutthe client system, including buffer size, in order to determine whetherthe state of the virtual TPM instance may be downloaded in one step orif multiple steps are required.

FIG. 4 is a block diagram depicting an example of migrating a virtualTPM instance to a physically separate destination platform, inaccordance with an exemplary embodiment of the present invention. FIG. 4depicts a system, generally denoted by reference number 400, with twophysically separate computers, Computer A 402 and Computer B 404.Computer A 402 comprises hypervisor 406, operating systems 410, 412, and414, and virtual TPM 420. Virtual TPM 420 is host to virtual TPMinstances, vTPM 430, 432, and 434. Each virtual TPM instance isassociated with one and only one operating system. System 400 showsoperating system 410 and vTPM 432 being migrated from Computer A 402 toComputer B 404. As the arrows indicate, operating system 410 and thestate information of vTPM 432 are frozen and stored. Operating system410 and vTPM 432 migrate through hypervisor 406 to hypervisor 408 ofComputer B 404. Operating system 410 and the state information of vTPM432 are restored, as shown. Virtual TPM instance vTPM 432 is restoredonto virtual TPM 422 of computer B 404.

FIG. 5 is a diagram of information flow that describes the high levelprocedure of migrating a virtual TPM instance from a source platform toa destination platform, in accordance with an exemplary embodiment ofthe present invention. The basis of virtual TPM instance migration isthe migration of an asymmetric key pair between a virtual TPM instanceon the source platform and a virtual TPM instance on the destinationplatform. In the example, the parent virtual TPM instance of theto-be-migrated virtual TPM instance on the source platform migrates anasymmetric key to the virtual TPM instance that will be the parent ofthe to-be-migrated virtual TPM instance on the destination platform(step 502). Asymmetric key migration is a standard feature of thespecification of the TPM and is therefore part of the capability of avirtual TPM instance implemented by this standard. The asymmetric keymigration makes the same key pair available to both parent virtual TPMinstances.

The virtual TPM migration is further based on the migration of asymmetric key from the parent virtual TPM instance on the sourceplatform to the parent virtual TPM instance on the destination platform.The migration application on the source platform requests a symmetrickey from the parent virtual TPM instance on the source platform (step504). In response to the received request, the parent virtual TPMinstance on the source platform encrypts a generated and internally-heldsymmetric key with the public key part of the migrated asymmetric keyand returns the encrypted symmetric key to the migration application onthe source platform (step 506). The encrypted symmetric key istransferred from the migration application on the source platform to themigration application on the destination platform (step 508). Themigration application on the destination platform submits the encryptedsymmetric key to the parent virtual TPM instance on the destinationplatform (step 510). The encrypted symmetric key is decrypted with theprivate key of the migrated asymmetric key and kept inside the virtualTPM instance that will receive the migrated state information (step512). A result code, indicating the success or failure of the decryptionis returned by the parent virtual TPM instance on the destinationplatform to the migration application on the destination platform (step514).

Additionally, the state of the to-be-migrated virtual TPM instance onthe source platform is encrypted by the parent virtual TPM instanceusing the symmetric key (step 516). Then the encrypted state informationof the to-be-migrated virtual TPM instance is transferred to thedestination platform (step 518) and is decrypted inside the parentvirtual TPM instance using the migrated symmetric key (step 520).

FIG. 6 is a diagram of information flow for migrating a virtual TPMinstance, in accordance with an exemplary embodiment of the presentinvention. The flow begins with the migration application on thedestination platform sending a command to the parent virtual TPMinstance on the destination platform to create an instance for migratingvirtual TPM instance state into (step 602). The parent virtual TPMinstance on the destination platform returns a unique migrationidentifier to the migration application on the destination platform(step 604). The migration application on the destination platformtransfers the unique identifier to the migration application on thesource platform (step 606). The migration application on the sourceplatform then communicates with the parent virtual TPM instance on thesource platform to first lock the virtual TPM instance (step 608) andthen to get the instance key (step 610). “Locking” the virtual TPMinstance means that the state of the virtual TPM instance is frozen andthat the virtual TPM instance will no longer accept normal TPM commands.A locked virtual TPM instance will only accept commands related tomigrating the virtual TPM instance. Then the state of the virtual TPMinstance is downloaded through the parent virtual TPM instance on thesource platform to the migration application on the source platform(step 612). While the state information is downloaded it is deleted fromto-be-migrated virtual TPM instance. The migration application on thesource platform receives the migration digest as a final piece of stateinformation. Next, the migration application on the source platformdeletes the source virtual TPM instance (step 614). The migrationapplication on the source platform transfers the state of the virtualTPM instance to the migration application on the destination platform(step 616). The migration application on the destination platformcommunicates with the parent virtual TPM instance and sets the TPMinstance key (step 618). Then the state of the virtual TPM instance isused to recreate the virtual TPM instance through the parent virtual TPMinstance on the destination platform (step 620). The migrationapplication on the destination platform communicates with the parentvirtual TPM instance on the destination platform to unlock the instancewhile also transferring the migration digest (step 622).

FIG. 7 is a diagram of information flow for exporting the stateinformation of a virtual TPM instance in multiple steps, in accordancewith an exemplary embodiment of the present invention. Data processingsystems often have limits to their buffer size. In some instances, thislimitation on the buffer size may prevent the downloading of the stateof the virtual TPM instance in a single step. In such cases, the stateof the virtual TPM instance needs to be migrated in multiple steps. Theinformation flow, generally denoted by reference number 700, is anillustrative example of performing step 518 of FIG. 5 in multiple steps.Communication is between the migration application on the sourceplatform and the parent virtual TPM instance of the to-be-migratevirtual TPM instance, but the state returned is the state of theto-be-migrate virtual TPM instance. Information flow 700 begins bydetermining the number of NV RAM areas available. To determine which NVRAM areas are available, the migration application on the sourceplatform sends a command GetCapability(NV RAM areas) to the parentvirtual TPM instance on the source platform and the parent virtual TPMinstance on the source platform replies to the migration application onthe source platform with an array of NVRAM area indices (step 702)available on the to-be-migrate virtual TPM instance. Next, in order todownload all NV RAM areas, the migration application on the sourceplatform sends the command GetInstanceData(NV RAM area “N”) and theparent virtual TPM instance on the source platform replies to themigration application on the source platform with a serialized NVRAMarea “N” (step 704) of the to-be-migrate virtual TPM instance. As eachreply is received by the migration application on the source platfrom,that particular piece of data, area “N” is deleted. In order todetermine which owner-evict keys are available, the migrationapplication on the source platform sends the command GetCapability(listof owner-evict keys) and the parent virtual TPM instance on the sourceplatform replies to the migration application on the source platformwith the list of available owner-evict keys (step 706) of theto-be-migrated virtual TPM instance. Owner-evict keys are keys thatsurvive rebooting the TPM. Next, the migration application on the sourceplatform downloads all owner-evict keys by sending the commandGetInstanceData(owner-evict key K) and the parent virtual TPM instanceon the source platform replies to the migration application on thesource platform with a serialized owner evict key (step 708) of theto-be-migrated virtual TPM instance. Then the migration application onthe source platform downloads all other TPM state information of theto-be-migrate virtual TPM instance.

FIG. 8 is a diagram of information flow for exporting the stateinformation of a virtual TPM instance in a single step, in accordancewith an exemplary embodiment of the present invention. FIG. 8 is anillustrative example of performing step 518 in FIG. 5 in a single step.The source platform downloads all the state information of theto-be-migrated virtual TPM instance in one step by the migrationapplication on the source platform sending the commandGetInstanceData(everything) to the parent virtual TPM instance on thesource platform and the parent virtual TPM instance on the sourceplatform replies.

FIG. 9 is a flowchart illustrating the operation of handling TPMcommands, particularly those related to virtual TPM management, inaccordance with an exemplary embodiment of the present invention. Theoperation begins with the TPM waiting to receive a command (step 902).Once a command is received, the TPM determines if the command is a“create TPM instance” command (step 904). If the command is the createTPM instance command (a yes output to step 904), then create the virtualTPM instance, as explained in greater detail in FIG. 10. If the commandis not the create TPM instance command (a no output to step 904), thenthe TPM determines if the command is a “lock TPM instance” command (step906).

If the command is the lock TPM instance command (a yes output to step906), then lock the virtual TPM instance, as explained in greater detailin FIG. 11. If the command is not the lock TPM instance command (a nooutput to step 908), then the TPM determines if the command is a “getTPM instance key” command (step 908).

If the command is the get TPM instance key command (a yes output to step908), then get the virtual TPM instance key, as explained in greaterdetail in FIG. 12. If the command is not the get TPM instance keycommand (a no output to step 908), then the TPM determines if thecommand is a “get TPM instance data” command (step 910).

If the command is the get TPM instance data command (a yes output tostep 910), then get the virtual TPM instance data, as explained ingreater detail in FIG. 13. If the command is not the get TPM instancedata command (a no output to step 910), then the TPM determines if thecommand is a “delete TPM instance” command (step 912).

If the command is the delete TPM instance command (a yes output to step912), then delete the virtual TPM instance data, as explained in greaterdetail in FIG. 14. If the command is not the delete TPM instance command(a no output to step 912), then the TPM determines if the command is a“set TPM instance key” command (step 914).

If the command is the set TPM instance key command (a yes output to step914), then set the virtual TPM instance key, as explained in greaterdetail in FIG. 15. If the command is not the set TPM instance keycommand (a no output to step 914), then the TPM determines if thecommand is a “set TPM instance data” command (step 916).

If the command is the set TPM instance data command (a yes output tostep 916), then set the virtual TPM instance data, as explained ingreater detail in FIG. 16. If the command is not the set TPM instancedata command (a no output to step 916), then the TPM determines if thecommand is a “unlock TPM instance” command (step 918).

If the command is the unlock TPM instance command (a yes output to step918), then unlock the virtual TPM instance, as explained in greaterdetail in FIG. 17. If the command is not the unlock TPM instance command(a no output to step 918), then the TPM verifies the validity of thecommand (step 920) and processes it as a normal TPM command, eventuallyreturning to step 902.

FIG. 10 is a flowchart illustrating the operation of handling a createTPM instance command in accordance with an exemplary embodiment of thepresent invention. In the present example, an empty virtual TPM instanceis being created at the destination platform. The operation begins byreceiving a command to create an instance as the child of instance P,where instance P is the parent instance (step 1002). Next the operationverifies if owner authorization for the command is valid (step 1004). Ifthe owner authorization for the command is not valid (a no output tostep 1004), the appropriate error code is sent as the result value (step1016) and the operation returns to step 902 of FIG. 9 to wait for a newcommand to process. If the owner authorization for the command is valid(a yes output to step 1004), the operation determines if instance P is adescendant of the processing virtual TPM instance (step 1006).

If instance P is not a descendant of the processing virtual TPM instance(a no output to step 1006), the appropriate error code is sent as theresult value (step 1016) and the operation returns to step 902 of FIG. 9to wait for a new command to process. If instance P is a descendant ofthe processing virtual TPM instance (a yes output to step 1006), theoperation determines if instance P is a privileged instance (step 1008).A privileged instance is an instance with permission to create other,child instances.

If instance P is not a privileged instance (a no output to step 1008),the appropriate error code is sent as the result value (step 1016) andthe operation returns to step 902 of FIG. 9 to wait for a new command toprocess. If instance P is a privileged instance (a yes output to step1008), the operation creates a virtual TPM instance as the child ofinstance P (step 1010). The virtual TPM is assigned a unique instancehandle H and a unique migration identifier (step 1010). A destinationlock is engaged for instance H (step 1012). As a lock has been engaged,instance H will now only accept commands related to migration of avirtual TPM instance and thus will remain empty until another virtualTPM instance is migrated to it or until it has been unlocked. Uniqueinstance handle H and the migration identifier are returned to thecaller (step 1014) and the operation returns to step 902 of FIG. 9 towait for a new command to process.

FIG. 11 is a flowchart illustrating the operation of handling a lock TPMinstance command in accordance with an exemplary embodiment of thepresent invention. The operation begins by receiving a command to lock avirtual TPM instance, instance H, associated with a unique migrationidentifier (step 1102). Next the operation verifies if ownerauthorization for the command is valid (step 1104). If the ownerauthorization for the command is not valid (a no output to step 1104),the appropriate error code is sent as the result value (step 1120) andthe operation returns to step 902 of FIG. 9 to wait for a new command toprocess. If the owner authorization for the command is valid (a yesoutput to step 1104), the operation determines if instance H is adescendant of the processing virtual TPM instance (step 1106). Ifinstance H is not a descendant of the processing virtual TPM instance (ano output to step 1106), the appropriate error code is sent as theresult value (step 1120) and the operation returns to step 902 of FIG. 9to wait for a new command to process.

If instance H is a descendant of the processing virtual TPM instance (ayes output to step 1106), the operation determines if the destinationlock is engaged (step 1110). If the destination lock is engaged (a yesoutput to step 1110), the appropriate error code is sent as the resultvalue (step 1120) and the operation returns to step 902 of FIG. 9 towait for a new command to process. If the destination lock is notengaged (a no output to step 1110), the operation engages a source lockfor instance P, which prevents instance P from accepting any TPMcommands except for those commands related to migrating the TPM (step1112). The operation initializes the migration session to the uniquemigration identifier for instance H (step 1114). The operation theninitializes the migration digest (step 1116). The migration digest is anexample of integrity data that is used to detect changes in the exportedstate of a virtual TPM instance. A result code, indicating the successof failure of the operation, is returned (step 1118) and then theoperation returns to step 902 of FIG. 9 to wait for a new command toprocess.

FIG. 12 is a flowchart illustrating the operation of handling a get TPMinstance key command in accordance with an exemplary embodiment of thepresent invention. The operation begins by receiving a command to get aninstance key for a virtual TPM instance, instance H, using storage key Sfor encryption (step 1202). Next the operation verifies if ownerauthorization for the command is valid (step 1204). If the ownerauthorization for the command is not valid (a no output to step 1204),the appropriate error code is sent as the result value (step 1220) andthe operation returns to step 902 of FIG. 9 to wait for a new command toprocess. If the owner authorization for the command is valid (a yesoutput to step 1204), the operation determines if instance H is adescendant of the processing virtual TPM instance (step 1206). Ifinstance H is not a descendant of the processing virtual TPM instance (ano output to step 1206), the appropriate error code is sent as theresult value (step 1220) and the operation returns to step 902 of FIG. 9to wait for a new command to process.

If instance H is a descendant of the processing virtual TPM instance (ayes output to step 1206), the operation determines if the authorizationof storage key S is valid (step 1208). If the authorization of storagekey S is not valid (a no output to step 1208), the appropriate errorcode is sent as the result value (step 1220) and the operation returnsto step 902 of FIG. 9 to wait for a new command to process. Ifauthorization of storage key S is valid (a yes output to step 1208), oninstance H, the operation creates a random symmetric key and forms asymmetric key structure with the random symmetric key (step 1210). Thenon instance H, the operation creates a random number to be used as anHMAC key for instance H (step 1212). The operation stores the randomsymmetric key on instance H (step 1214). The operation then stores theHMAC key on instance H (step 1216). On instance H, the operationconcatenates the symmetric key structure and the HMAC key and encryptsthe concatenated item with key S (step 1218). The operation returns theencrypted item to the caller (step 1222) and the operation returns tostep 902 of FIG. 9 to wait for a new command to process.

FIG. 13 is a flowchart illustrating the operation of handling a get TPMinstance data command in accordance with an exemplary embodiment of thepresent invention. The operation begins by receiving a command to getinstance data from a virtual TPM instance, instance H (step 1302). Nextthe operation verifies if owner authorization for the command is valid(step 1304). If the owner authorization for the command is not valid (ano output to step 1304), the appropriate error code is sent as theresult value (step 1326) and the operation returns to step 902 of FIG. 9to wait for a new command to process. If the owner authorization for thecommand is valid (a yes output to step 1304), the operation determinesif instance H is a descendant of the processing virtual TPM instance(step 1306). If instance H is not a descendant of the processing virtualTPM instance (a no output to step 1306), the appropriate error code issent as the result value (step 1326) and the operation returns to step902 of FIG. 9 to wait for a new command to process.

If instance H is a descendant of the processing virtual TPM instance (ayes output to step 1306), the operation determines if an instance keyhas been set (step 1308). If the instance key has not been sent (a nooutput to step 1308), the appropriate error code is sent as the resultvalue (step 1326) and the operation returns to step 902 of FIG. 9 towait for a new command to process. If an instance key has been set (ayes output to step 1308), the operation determines if a source lock hasbeen engaged (step 1310). If a source lock has not been engaged (a nooutput to step 1310), the appropriate error code is sent as the resultvalue (step 1326) and the operation returns to step 902 of FIG. 9 towait for a new command to process. If a source lock has been engaged (ayes output to step 1310), the operation serializes the requested pieceof data of instance H (step 1312). The operation calculates an HMAC overthe serialized data using the instance HMAC key as the key (step 1314).The operation updates the migration digest by extending its currentvalue with the hash of the serialized data (step 1316). The operationappends the HMAC to the serialized data (step 1318). The operationencrypts the serialized data including the HMAC using the instance key(step 1320). The operation returns the migration digest if this data isdetermined to be the last block of downloaded information (step 1322).The operation returns the encrypted data to the caller (step 1324) andthe operation returns to step 902 of FIG. 9 to wait for a new command toprocess.

FIG. 14 is a flowchart illustrating the operation of handling a deleteTPM instance command in accordance with an exemplary embodiment of thepresent invention. The operation begins by receiving a command to deletea virtual TPM instance with unique handle H, instance H (step 1402).Next the operation verifies if owner authorization for the command isvalid (step 1404). If the owner authorization for the command is notvalid (a no output to step 1404), the appropriate error code is sent asthe result value (step 1414) and the operation returns to step 902 ofFIG. 9 to wait for a new command to process. If the owner authorizationfor the command is valid (a yes output to step 1404), the operationdetermines if instance H is a descendant of the processing virtual TPMinstance (step 1406). If instance H is not a descendant of theprocessing virtual TPM instance (a no output to step 1406), theappropriate error code is sent as the result value (step 1414) and theoperation returns to step 902 of FIG. 9 to wait for a new command toprocess.

If instance H is a descendant of the processing virtual TPM instance (ayes output to step 1406), the operation determines if instance H has anydescendants (step 1408). If instance H has descendants (a yes output tostep 1408), the appropriate error code is sent as the result value (step1414) and the operation returns to step 902 of FIG. 9 to wait for a newcommand to process. If instance H does not have any descendants (a nooutput to step 1408), the operation deletes all data associated withinstance H (step 1410). The operation deletes all reference to instanceH from instance H's direct parent (step 1412) and the operation returnsto step 902 of FIG. 9 to wait for a new command to process.

FIG. 15 is a flowchart illustrating the operation of handling a set TPMinstance key command in accordance with an exemplary embodiment of thepresent invention. The operation begins by receiving a command to set aninstance key for a virtual TPM instance, instance H, using storage key Sfor encryption (step 1502). Next the operation verifies if ownerauthorization for the command is valid (step 1504). If the ownerauthorization for the command is not valid (a no output to step 1504),the appropriate error code is sent as the result value (step 1518) andthe operation returns to step 902 of FIG. 9 to wait for a new command toprocess. If the owner authorization for the command is valid (a yesoutput to step 1504), the operation determines if instance H is adescendant of the processing virtual TPM instance (step 1506). Ifinstance H is not a descendant of the processing virtual TPM instance (ano output to step 1506), the appropriate error code is sent as theresult value (step 1518) and the operation returns to step 902 of FIG. 9to wait for a new command to process.

If instance H is a descendant of the processing virtual TPM instance (ayes output to step 1506), the operation determines if the authorizationof storage key S is valid (step 1508). If the authorization of storagekey S is not valid (a no output to step 1508), the appropriate errorcode is sent as the result value (step 1518) and the operation returnsto step 902 of FIG. 9 to wait for a new command to process. Ifauthorization of storage key S is valid (a yes output to step 1508), theoperation decrypts the given encrypted item using the private key ofstorage key S and extracts a symmetric key structure and an HMAC key(step 1510). Then the operation determines if the symmetric keystructure is valid (step 1512). If the symmetric key structure is notvalid (a no output to step 1512), the appropriate error code is sent asthe result value (step 1518) and the operation returns to step 902 ofFIG. 9 to wait for a new command to process. If the symmetric keystructure is valid (a yes output to step 1512), the operation stores thesymmetric key as part of instance H's state (step 1514). The operationthen stores the HMAC key as part of instance H's state (step 1516) andthe operation returns to step 902 of FIG. 9 to wait for a new command toprocess.

FIG. 16 is a flowchart illustrating the operation of handling a set TPMinstance data command in accordance with an exemplary embodiment of thepresent invention. The operation begins by receiving a command to setthe instance data of a virtual TPM instance, instance H (step 1602).Next the operation verifies if owner authorization for the command isvalid (step 1604). If the owner authorization for the command is notvalid (a no output to step 1604), the appropriate error code is sent asthe result value (step 1622) and the operation returns to step 902 ofFIG. 9 to wait for a new command to process. If the owner authorizationfor the command is valid (a yes output to step 1604), the operationdetermines if instance H is a descendant of the processing virtual TPMinstance (step 1606). If instance H is not a descendant of theprocessing virtual TPM instance (a no output to step 1606), theappropriate error code is sent as the result value (step 1622) and theoperation returns to step 902 of FIG. 9 to wait for a new command toprocess.

If instance H is a descendant of the processing virtual TPM instance (ayes output to step 1606), the operation determines if an instance keyhas been set (step 1608). If the instance key has not been set (a nooutput to step 1608), the appropriate error code is sent as the resultvalue (step 1622) and the operation returns to step 902 of FIG. 9 towait for a new command to process. If an instance key has been set (ayes output to step 1608), the operation determines if a destination lockhas been engaged (step 1610). If a destination lock has not been engaged(a no output to step 1610), the appropriate error code is sent as theresult value (step 1622) and the operation returns to step 902 of FIG. 9to wait for a new command to process. If a destination lock has beenengaged (a yes output to step 1610), the operation decrypts the datausing the instance key (step 1612). The operation then determines if theHMAC found in the decrypted data is correct (step 1614). If the HMACfound in the decrypted data is not correct (a no output to step 1614),the appropriate error code is sent as the result value (step 1622) andthe operation returns to step 902 of FIG. 9 to wait for a new command toprocess. If the HMAC found in the decrypted data is correct (a yesoutput to step 1614), the operation determines if the unique migrationidentifier found in the decrypted data is correct (step 1616). If theunique migration identifier found in the decrypted data is not correct(a no output to step 1616), the appropriate error code is sent as theresult value (step 1622) and the operation returns to step 902 of FIG. 9to wait for a new command to process. If the unique migration identifierfound in the decrypted data is correct (a yes output to step 1616), theoperation recreates the state of instance H by deserializing thedecrypted byte stream (step 1618). The operation extends the migrationdigest of instance H with the decrypted data (step 1620) and theoperation returns to step 902 of FIG. 9 to wait for a new command toprocess.

FIG. 17 is a flowchart illustrating the operation of handling an unlockTPM instance command in accordance with an exemplary embodiment of thepresent invention. The operation begins by receiving a command to unlocka virtual TPM instance, instance H, associated with a migration digest(step 1702). Next the operation verifies if owner authorization for thecommand is valid (step 1704). If the owner authorization for the commandis not valid (a no output to step 1704), the appropriate error code issent as the result value (step 1716) and the operation returns to step902 of FIG. 9 to wait for a new command to process. If the ownerauthorization for the command is valid (a yes output to step 1704), theoperation determines if instance H is a descendant of the processingvirtual TPM instance (step 1706). If instance H is not a descendant ofthe processing virtual TPM instance (a no output to step 1706), theappropriate error code is sent as the result value (step 1716) and theoperation returns to step 902 of FIG. 9 to wait for a new command toprocess.

If instance H is a descendant of the processing virtual TPM instance (ayes output to step 1706), the operation determines if the passed andinternal migration digests match (step 1708). If the passed and internalmigration digests do not match (a no output to step 1708), theappropriate error code is sent as the result value (step 1716) and theoperation returns to step 902 of FIG. 9 to wait for a new command toprocess. If the passed and internal migration digests match (a yesoutput to step 1708), the operation clears the migration session withthe unique migration identifier of instance H (step 1710). The operationdisengages the destination lock of instance H (step 1712). The operationdisengages the source lock of instance H (step 1714) and the operationreturns to step 902 of FIG. 9 to wait for a new command to process.

Thus the present invention provides a computer implemented method, dataprocessing system, and computer program product for migrating a trustedplatform module instance. The method also ensures the uniqueness andcompleteness of the migrated trusted platform module instance.

The invention can take the form of an entirely hardware embodiment, anentirely software embodiment or an embodiment containing both hardwareand software elements. In a preferred embodiment, the invention isimplemented in software, which includes but is not limited to firmware,resident software, microcode, etc.

Furthermore, the invention can take the form of a computer programproduct accessible from a computer-usable or computer-readable mediumproviding program code for use by or in connection with a computer orany instruction execution system. For the purposes of this description,a computer-usable or computer readable medium can be any tangibleapparatus that can contain, store, communicate, propagate, or transportthe program for use by or in connection with the instruction executionsystem, apparatus, or device.

The medium can be an electronic, magnetic, optical, electromagnetic,infrared, or semiconductor system (or apparatus or device) or apropagation medium. Examples of a computer-readable medium include asemiconductor or solid-state memory, magnetic tape, a removable computerdiskette, a random access memory (RAM), a read-only memory (ROM), arigid magnetic disk and an optical disk. Current examples of opticaldisks include compact disk-read only memory (CD-ROM), compactdisk-read/write (CD-R/W), and digital video disc (DVD).

A data processing system suitable for storing and/or executing programcode will include at least one processor coupled directly or indirectlyto memory elements through a system bus. The memory elements can includelocal memory employed during actual execution of the program code, bulkstorage, and cache memories which provide temporary storage of at leastsome program code in order to reduce the number of times code shouldpreferably be retrieved from bulk storage during execution.

Input/output or I/O devices (including but not limited to keyboards,displays, pointing devices, etc.) can be coupled to the system eitherdirectly or through intervening I/O controllers.

Network adapters may also be coupled to the system to enable the dataprocessing system to become coupled to other data processing systems orremote printers or storage devices through intervening private or publicnetworks. Modems, cable modems, and Ethernet cards are just a few of thecurrently available types of network adapters.

The description of the present invention has been presented for purposesof illustration and description, and is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the art. Theembodiment was chosen and described in order to best explain theprinciples of the invention, the practical application, and to enableothers of ordinary skill in the art to understand the invention forvarious embodiments with various modifications as are suited to theparticular use contemplated.

1. A computer implemented method for migrating a virtual trustedplatform module instance, the computer implemented method comprising:locking a child virtual trusted platform module instance on adestination platform, wherein locking the child virtual trusted platformmodule instance comprises freezing a state of the child trusted moduleinstance, wherein once frozen, the child trusted module instance will nolonger accept normal trusted platform module commands, but will onlyaccept commands related to migrating the virtual trusted module, whereina state of a virtual trusted platform module is imported after the childvirtual trusted platform module instance on the destination platform hasbeen locked and wherein the child virtual trusted platform moduleinstance on the destination platform cannot be unlocked unless all thestate of the virtual trusted platform module has been imported;exporting the state of the virtual trusted platform module instancethrough a parent virtual trusted platform module instance on a sourceplatform, wherein the parent virtual trusted platform module instance onthe source platform has control over a life-cycle of the virtual trustedplatform module instance on the source platform; and importing the stateof the virtual trusted platform module instance through a parent virtualtrusted platform module instance on a destination platform, wherein theparent virtual trusted platform module instance on the destinationplatform has control over a life-cycle of the virtual trusted platformmodule instance on the destination platform.
 2. The computer implementedmethod of claim 1, wherein the source platform and the destinationplatform are on different physical platforms.
 3. The computerimplemented method of claim 1, further comprising: deleting the state ofthe virtual trusted platform module instance on the source platform. 4.The computer implemented method of claim 1, wherein the state of thevirtual trusted platform module instance is streamed from the sourceplatform to the destination platform using a transfer protocol based ona network transmission protocol.
 5. The computer implemented method ofclaim 1, wherein the state of the virtual trusted platform moduleinstance is exported in a plurality of steps and wherein the state ofthe virtual trusted platform module instance is imported in a pluralityof steps.
 6. The computer implemented method of claim 1, furthercomprising: adding integrity data to the state of the virtual trustedplatform module instance by the parent virtual trusted platform moduleinstance on the source platform; and validating the integrity data bythe parent virtual trusted platform module instance on the destinationplatform.
 7. The computer implemented method of claim 6, wherein theintegrity data is a migration digest
 8. The computer implemented methodof claim 7, further comprising: wherein exporting the state of thevirtual trusted platform module instance comprises serializing eachpiece of the state of the virtual trusted platform module instance intoa byte stream, wherein the parent virtual trusted platform moduleinstance on the source platform forms each serialized byte stream into asource digest; accumulating all source digests to form a final sourcedigest; exporting the final source digest; receiving the serialized bytestreams by the parent virtual trusted platform module instance on thedestination platform, wherein the parent virtual trusted platform moduleinstance on the destination platform forms each serialized byte streaminto a destination digest; accumulating all the destination digests toform a final destination digest; and comparing the final source digestto the final destination digest.
 9. The computer implemented method ofclaim 1, further comprising: preventing the state of the virtual trustedplatform module instance from being imported by a plurality of parentvirtual trusted platform module instances.
 10. The computer implementedmethod of claim 9, wherein the step of preventing the state of thevirtual trusted platform module instance from being imported by aplurality of parent virtual trusted platform module instances comprises:generating a unique migration identifier; adding the unique migrationidentifier to the state of the trusted platform module instance; andverifying the migration identifier by the destination trusted platformmodule instance.
 11. The computer implemented method of claim 10,wherein the parent virtual trusted platform module instance on thedestination platform generates the unique migration identifier and theunique migration identifier is sent to the parent virtual trustedplatform module instance on the source platform and wherein the parentvirtual trusted platform module instance on the source platform adds theunique migration identifier to the state of the virtual trusted platformmodule instance.
 12. The computer implemented method of claim 1, furthercomprising: encrypting the state of the virtual trusted platform moduleinstance before the state of the virtual trusted platform moduleinstance is exported; and decrypting the state of the virtual trustedplatform module instance after the state of the virtual trusted platformmodule instance is imported.
 13. The computer implemented method ofclaim 12, wherein the steps of exporting and importing the state of thevirtual trusted platform module instance comprises: exchanging asymmetric key between the parent virtual trusted platform moduleinstance on the source platform and the parent virtual trusted platforminstance on the destination platform; and encrypting the state of thevirtual trusted platform module instance on the source platform with thesymmetric key; and decrypting the state of the virtual trusted platformmodule instance on the destination platform with the symmetric key. 14.The computer implemented method of claim 13, wherein the step ofexchanging the symmetric key between the parent virtual trusted platformmodule instance on the source platform and the parent virtual trustedplatform module instance on the destination platform comprises:generating a random symmetric key by the parent virtual trusted platformmodule instance on the source platform; encrypting the random symmetrickey using a public key; and exporting the encrypted random symmetric keyto the parent virtual trusted platform module instance on thedestination platform, wherein the parent virtual trusted platform moduleinstance on the destination platform decrypts the encrypted randomsymmetric key by using a private key associated with the public key. 15.The computer implemented method of claim 1, further comprising:appending a message authentication code to the state of the virtualtrusted platform module instance; and verifying the messageauthentication code.
 16. The computer implemented method of claim 15,further comprising: generating a key used for the message authenticationcode by the parent virtual trusted platform module instance on thesource platform; exchanging the key between the parent virtual trustedplatform module on the source platform with the parent virtual trustedplatform module on the destination platform; and wherein the key is usedfor verification of the message authentication code by the parentvirtual trusted platform module instance on the destination platform.17. The computer implemented method of claim 16, wherein the steps ofgenerating the key for the message authentication code and exchangingthe key between the parent virtual trusted platform module on the sourceplatform with the parent virtual trusted platform module on thedestination platform comprises: generating an authentication key by theparent virtual trusted platform module instance on the source platform;and encrypting the authentication key with a public key by the parentvirtual trusted platform module instance on the source platform; anddecrypting the authentication key using a private key associated withthe public key by the parent virtual trusted platform module instance onthe destination platform.
 18. The computer implemented method of claim1, further comprising: locking the virtual trusted platform moduleinstance, wherein locking the virtual trusted platform module instancecomprises freezing the state of the virtual trusted module instance,wherein once frozen, the virtual trusted module instance will no longeraccept normal trusted platform module commands, but will only acceptcommands related to migrating the virtual trusted module, wherein thestate of the virtual trusted platform module instance may be exportedafter the virtual trusted module instance has been locked and whereinthe virtual trusted platform module instance cannot be unlocked once thevirtual trusted platform module instance has been locked.
 19. A computerprogram product comprising a tangible computer usable medium includingcomputer usable program code for the migration of virtual trustedplatform module instances, said computer program product comprising:computer usable program code for locking a child virtual trustedplatform module instance on a destination platform, wherein locking thechild virtual trusted platform module instance comprises freezing astate of the child trusted module instance, wherein once frozen, thechild trusted module instance will no longer accept normal trustedplatform module commands, but will only accept commands related tomigrating the virtual trusted module, wherein a state of a virtualtrusted platform module is imported after the child virtual trustedplatform module instance on the destination platform has been locked andwherein the child virtual trusted platform module instance on thedestination platform cannot be unlocked unless all the state of thevirtual trusted platform module has been imported; computer usableprogram code for exporting the state of the virtual trusted platformmodule instance through a parent virtual trusted platform moduleinstance on a source platform, wherein the parent virtual trustedplatform module instance on the source platform has control over alife-cycle of the virtual trusted platform module instance on the sourceplatform; and computer usable program code for importing the state ofthe virtual trusted platform module instance through a parent virtualtrusted platform module instance on a destination platform, wherein theparent virtual trusted platform module instance on the destinationplatform has control over a life-cycle of the virtual trusted platformmodule instance on the destination platform.
 20. The computer programproduct of claim 19, further comprising: computer usable program codefor deleting the state of the virtual trusted platform module instanceon the source platform.
 21. The computer program product of claim 19,wherein the computer useable program code for exporting the state of thevirtual trusted platform module instance comprises computer useableprogram code for exporting the state of the virtual trusted platformmodule instance in a plurality of steps and wherein the computer useableprogram code for importing the state of the virtual trusted platformmodule instance comprises computer useable program code for importingthe virtual trusted platform module instance in a plurality of steps.22. The computer program product of claim 19, further comprising:computer usable program code for adding integrity data to the state ofthe virtual trusted platform module instance by the parent virtualtrusted platform module instance on the source platform; and computerusable program code for validating the integrity data by the parentvirtual trusted platform module instance on the destination platform.23. The computer program product of claim 22, further comprising:wherein the integrity data is a migration digest; wherein the computerusable program code exporting the state of the virtual trusted platformmodule instance comprises computer usable program code for serializingeach piece of the state of the virtual trusted platform module instanceinto a byte stream, wherein the parent virtual trusted platform moduleinstance on the source platform forms each serialized byte stream into asource digest; computer usable program code for accumulating all sourcedigests to form a final source digest; computer usable program code forexporting the final source digest; computer usable program code forreceiving the serialized byte streams by the parent virtual trustedplatform module instance on the destination platform, wherein the parentvirtual trusted platform module instance on the destination platformforms each serialized byte stream into a destination digest; computerusable program code for accumulating all the destination digests to forma final destination digest; and computer usable program code forcomparing the final source digest to the final destination digest. 24.The computer program product of claim 19, further comprising: computerusable program code for preventing the state of the virtual trustedplatform module instance from being imported by a plurality of parentvirtual trusted platform module instances.
 25. The computer programproduct of claim 24, wherein the computer usable program code forpreventing the state of the virtual trusted platform module instancefrom being imported by a plurality of parent virtual trusted platformmodule instances comprises: computer usable program code for generatinga unique migration identifier; computer usable program code for addingthe unique migration identifier to the state of the trusted platformmodule instance; and computer usable program code for verifying themigration identifier by the destination trusted platform moduleinstance.
 26. The computer program product of claim 19, furthercomprising: computer usable program code for encrypting the state of thevirtual trusted platform module instance before the state of the virtualtrusted platform module instance is exported; and computer usableprogram code for decrypting the state of the virtual trusted platformmodule instance after the state of the virtual trusted platform moduleinstance is imported.
 27. The computer program product of claim 26,wherein the computer usable program code for encrypting the state of thevirtual trusted platform module instance and the computer usable programcode for decrypting the state of the virtual trusted platform moduleinstance comprises: computer usable program code for generating a randomsymmetric key by the parent virtual trusted platform module instance onthe source platform; computer usable program code for encrypting therandom symmetric key using a public key; and computer usable programcode for exporting the encrypted random symmetric key to the parentvirtual trusted platform module instance on the destination platform,wherein the parent virtual trusted platform module instance on thedestination platform decrypts the encrypted random symmetric key byusing a private key associated with the public key; computer usableprogram code for encrypting the state of a virtual trusted platformmodule instance on the source platform by the parent virtual trustedplatform module instance using the random symmetric key; and computerusable program code for decrypting the state of the virtual trustedplatform module instance on the destination platform by the parentvirtual trusted platform module instance using the random symmetric key.28. The computer program product of claim 19, further comprising:computer usable program code for appending a message authentication codeto the state of the virtual trusted platform module instance; andcomputer usable program code for verifying the message authenticationcode.
 29. The computer program product of claim 28, wherein the computerusable program code for appending a message authentication code to thestate of the virtual trusted platform module instance and the computerusable program code for verifying the message authentication codecomprises: computer usable program code for generating an authenticationkey by the parent virtual trusted platform module instance on the sourceplatform; computer usable program code for encrypting the authenticationkey with a public key by the parent virtual trusted platform moduleinstance on the source platform; computer usable program code forexporting the encrypted authentication key by the parent virtual trustedplatform module instance on the source platform; computer usable programcode for importing the encrypted authentication key by the parentvirtual trusted platform module instance on the destination platform;computer usable program code for decrypting the authentication key usinga private key associated with the public key by the parent virtualtrusted platform module instance on the destination platform; computerusable program code for appending a message authentication code to thestate of a virtual trusted platform module instance on the sourceplatform by the parent virtual trusted platform module instance usingthe authentication key; and computer usable program code for verifyingthe appended message authentication code by the parent virtual trustedplatform module instance on the destination platform using theauthentication key.
 30. The computer program product of claim 19,further comprising: computer usable program code for locking the virtualtrusted platform module instance, wherein locking the virtual trustedplatform module instance comprises freezing the state of the virtualtrusted module instance, wherein once frozen, the virtual trusted moduleinstance will no longer accept normal trusted platform module commands,but will only accept commands related to migrating the virtual trustedmodule, wherein the state of the virtual trusted platform moduleinstance is exported after the virtual trusted module instance has beenlocked and wherein the virtual trusted platform module instance cannotbe unlocked once the virtual trusted platform module instance has beenlocked.
 31. A system for the migration of virtual trusted platformmodule instances, comprising: a storage device, wherein the storagedevice stores computer usable program code; and a processor, wherein theprocessor executes the computer usable program code to: a child virtualtrusted platform module instance on a destination platform, whereinlocking the child virtual trusted platform module instance comprisesfreezing a state of the child trusted module instance, wherein oncefrozen, the child trusted module instance will no longer accept normaltrusted platform module commands, but will only accept commands relatedto migrating the virtual trusted module, wherein a state of a virtualtrusted platform module is imported after the child virtual trustedplatform module instance on the destination platform has been locked andwherein the child virtual trusted platform module instance on thedestination platform cannot be unlocked unless all the state of thevirtual trusted platform module has been imported; to export the stateof the virtual trusted platform module instance through a parent virtualtrusted platform module instance on a source platform; and to import thestate of the virtual trusted platform module instance through a parentvirtual trusted platform module instance on a destination platform.